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February 19, 2020 
Ref: DODOIG-2020-000516 


SENT VIA EMAIL TO: john@greenewald.com 
Mr. John Greenwald 

The Black Vault 

27305 W. Live Oak Road, Suite 1203 

Castaic, CA 91384 


Dear Mr. Greenwald: 


This responds to your Freedom of Information Act (FOIA) request for a copy of report 
05-INTEL-10, National Security Agency Data Call Submissions and Internal Control Processes 
for Base Realignment and Closure 2005. We received your request on February 13, 2020, and 
assigned it case number DODOIG-2020-0005 16. 


The FOIA, Privacy, and Civil Liberties Office conducted a search and found the enclosed 
record responsive to your request. We determined that the redacted portions are exempt from 
release pursuant to 5 U.S.C. § 552 (b)(6), which pertains to information, the release of which 
would constitute a clearly unwarranted invasion of personal privacy. 


If you consider this an adverse determination, you may submit an appeal. Your appeal, if 
any, must be postmarked within 90 days of the date of this letter. Since you have created an 
account in FOJAonline, please log in to your account, retrieve your original request, and then 
click on the “Create Appeal” tab in the left-hand column. FOJAonline will populate your request 
and contact information automatically. In the “Basis for Appeal” box, provide your explanation, 
attach supporting document (if necessary), click on preview, and then click on submit. Your 
appeal will automatically be sent to our office via FOIAonline. For more information on 
appellate matters and administrative appeal procedures, please refer to 32 C.F.R. Sec. 286.9(e) 
and 286.1 1(a). 


You may contact our FOJA Public Liaison at FOIAPublicLiaison@dodig.mil or by 
calling 703-604-9785, for any further assistance with your request. Additionally, you may 
contact the Office of Government Information Services (OGIS) at the National Archives and 
Records Administration to inquire about the FOIA mediation services they offer. The contact 
information for OGIS is as follows: Office of Government Information Services, National 
Archives and Records Administration, 8601 Adelphi Road-OGIS, College Park, Maryland 
20740-6001, e-mail at ogis@nara.gov; telephone at 202-741-5770; toll free at 1-877-684-6448; 
or facsimile at 202-741-5769. However, OGIS does not have the authority to mediate requests 
made under the Privacy Act of 1974 (request to access one’s own records). 
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If you have any questions regarding this matter, please contact this office at 703-604- 
9775 or via email to foiarequests@dodig.mil. 


Sincerely, 


Barbara Gonzalez 
Division Chief 
FOIA, Privacy and Civil Liberties Office 
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May 13, 2005 
MEMORANDUM FOR DIRECTOR, NATIONAL SECURITY AGENCY 


SUBJECT: Report on National Security Agency Data Call Submissions and Internal 
Control Processes for Base Realignment and Closure 2005 
(Report No. 05-INTEL-10) 


We are providing this report for information and use. We performed the audit in 
response to a request from the Under Secretary of Defense for Acquisition, Technology, 
and Logistics. We considered management comments on a draft of this report in 


preparing the final report. The complete text of the comments is in the Management 
Comments section of the report. 


Comments on the draft of this report conformed to the requirements of DoD 
Directive 7650.3 and left no unresolved issues, Therefore, no additional comments are 
required. 


We appreciate the courtesies extended to the staff. Questions should be directed 
to at (703) 604. (DSN 664- ) or aes at 
(703) 604. 664 ). See Appendix C for the report distribution. The team 


members are listed inside the back cover. 


Shelton R. 
Assistant Inspector General 
for Intelligence 

















Department of Defense Office of Inspector General 


Report No. 05-INTEL-10 May 13, 2005 
(Project No. D2004-DINTEL-0073.000) 


National Security Agency Data Call Submissions 
and Internal Control Processes for Base 
Realignment and Closure 2005 


Executive Summary 


Who Should Read This Report and Why? Office of the Secretary of Defense 
personnel responsible for deciding the realignment or closure of military installations 
based on the Base Realignment and Closure (BRAC) data calls and National Security 
Agency management personnel should read this report. The report discusses the validity, 
integrity, and supporting documentation of the data provided by the National Security 
Agency to assist the Secretary of Defense in BRAC 2005 recommendations. 


Background. BRAC 2005 is the formal process outlined in Public Law 101-510, 
“Defense Base Closure and Realignment Act of 1990,” as amended, under which the 
Secretary of Defense may realign or close military installations inside the United States 
and its territories. As part of BRAC 2005, the Under Secretary of Defense for 
Acquisition, Technology, and Logistics issued, “Transformation Through Base 
Realignment and Closure (BRAC 2005) Policy Memorandum One-Policy, 
Responsibilities, and Procedures,” April 16, 2003, which stated that the DoD Office of 
Inspector General would review the accuracy of BRAC data and the certification process. 


The BRAC 2005 process was mandated for the United States and its territories and was 
divided into the following data calls — capacity analysis, supplemental capacity, Military 
value, Cost of Base Realignment Actions, Joint Process Action Team Criterion Number 
7, and scenario specific. The Intelligence agencies’ collection process was divided into 
the following data calls — capacity analysis, Military value, and scenario specific. We 
issued site memorandums for the capacity analysis data call and Military value data call 
to summarize the results of the site visits. This report summarizes the data calls as of 
April 2005, for the National Security Agency BRAC 2005 process. 


The National Security Agency, located in Fort Meade, Maryland, is America’s 
cryptologic organization, it coordinates, directs, and performs highly specialized 
activities to protect the United States information systems and produce foreign 
intelligence information. The National Security Agency was required to perform only the 
capacity analysis, Military value, and scenario specific data calls. 


Results. We evaluated the validity, integrity, and supporting documentation of 
BRAC 2005 data calls that the National Security Agency submitted for the capacity 














analysis, Military value, and scenario specific data calls. The National Security Agency 
BRAC 2005 data collection was generally not fully supported. The National Security 
Agency collected and submitted responses to 17 questions during the capacity analysis 
data call, 7 of which were partially supported and 2 unsupported. The National Security 
Agency collected and submitted responses to 1 | questions during the Military value data 
call, 8 of which were partially supported. We also reviewed the National Security 
Agency compliance with the Office of the Secretary of Defense and National Security 
Agency internal control plans. The National Security Agency internal control plan 
properly incorporated and supplemented the Office of the Secretary of Defense internal 
control plan. However, the data collection processes generally did not comply with the 
National Security Agency and Office of the Secretary of Defense internal control plans. 
Policies, procedures and management of the data collection were not followed. 
Responses were not certified as accurate and complete by responders and nondisclosure 
agreements were not signed and maintained. In addition, several BRAC 2005 documents 
used to support responses were not marked with the appropriate warnings in both the 
header and footer, and data collection requirements were not followed. The lack of 
adequate supporting documentation for the capacity analysis, Military value, scenario 
specific data calls and identified noncompliances with the internal control plans could 
impact the reliability and integrity of data that the National Security Agency provided for 
the BRAC 2005 analysis. 


Management Comments. Although no comments were required, the National Security 
Agency generally agreed with the overall report. However, regarding the problems 
identified, National Security Agency stated that this was the first time that intelligence 
functions were included in BRAC and there was a steep learning curve. Specifically, 
they agreed that BRAC documents were not properly marked and that some question 
were not fully supported. However, the National Security Agency disagreed with the 
tone of the report, and felt that that no additional supporting documentation could have 
been provided. In addition, National Security Agency felt that all nondisclosure 
agreements and certifications were signed by individuals involved in the BRAC process. 
See the Finding section of the report for a discussion of management comments and the 
Management Comments section for the complete text of the comments. 


Audit Response. We agree with the National Security Agency that the BRAC 2005 
process was new to the Intelligence Community. However, the Office of the Secretary of 
Defense and the National Security Agency internal control procedures were not being 
followed which resulted in policies, procedures and management of the data collection 
not being effectively implemented and executed. 


We played a pro-active role with the National Security Agency prior to validating the 
data calls. We visited the National Security Agency prior to our validation of data to 
discuss, and give examples of adequate supporting documentation for each question. 
During our validation of the data calls, we recognized that some data was not available; 
however, we identified instances were additional supporting documentation, detailed 
methodologies or amendments to data could have fully supported some National Security 
Agency responses. During numerous visits and discussions with management little or no 
additional documentation was provided. 








If as stated by National Security Agency, that all nondisclosure agreements and 
certification statements have been signed; we are pleased with the corrective action 
taken. However, during our validation, we identified and National Security Agency 
stated that several individuals who had knowledge of the BRAC process did not sign 
nondisclosure agreements. In addition, individuals with substantial involvement in the 
preparation and submissions of information did not provide certification statements at 
their level as required in the National Security Agency internal control plan. The lack of 
adequate oversight, noncompliance with the internal control plan written by National 
Security Agency, and the lack of adequate supporting documentation are the basis for 
questioning the reliability and integrity of the data. 
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Background 


Base Realignment and Closure 2005. Public Law 101-510, “Defense Base 
Closure and Realignment Act of 1990,” as amended, establishes the procedures 
under which the Secretary of Defense may realign or close military installations 
inside the United States and its territories. The law authorizes the establishment 
of an independent Commission to review the Secretary of Defense 
recommendations for realigning and closing military installations. The Secretary 
of Defense established and chartered the Infrastructure Executive Council and the 
Infrastructure Steering Group as the Base Realignment and Closure (BRAC) 2005 
deliberative bodies responsible for leadership, direction, and guidance. The 
Secretary of Defense must submit BRAC recommendations to the independent 
Commission by May 16, 2005. 


Joint Cross-Service Groups. A primary objective of BRAC 2005, in addition to 
realigning base structure, is to examine and implement opportunities for greater 
joint activity, The Office of the Secretary of Defense (OSD) established seven 
Joint Cross-Service Groups (JCSG) — Education and Training, Headquarters and 
Support Activities, Industrial, Intelligence, Medical, Supply and Storage, and 
Technical to address issues that are common business-oriented support functions, 
examine functions in the context of facilities, and develop realignment and 
closure recommendations based on force structure plans of the Armed Forces and 
on selection criteria. To analyze the issues, each JCSG developed data call 
questions to obtain information about the functions that they reviewed. 


BRAC Data Calls. The BRAC 2005 data collection process was mandated for 
the United States and its territories. The collection process was divided into the 
following data calls — capacity analysis, supplemental capacity, Military value, 
Cost of Base Realignment Actions (COBRA), Joint Process Action Team 
Criterion Number 7 and scenario specific. The supplemental capacity analysis, 
Military value, COBRA, and Joint Process Action Team Criterion Number 7 data 
calls are collectively known as the second data call. The Services, Defense 
agencies, and Defense-wide Organizations used either automated data collection 
tools or a manual process to collect data call responses. Each data call had a 
specific purpose as follows. 


e The capacity analysis data call gathered data on infrastructure, current 
workload, surge requirements, and maximum capacity. 


e The'supplemental capacity data call clarified inconsistent data 
gathered during the initial capacity analysis data call. 


e The Military value data call gathered data on mission requirements, 
survivability, land and facilities, mobilization, and contingency. 








BRAC related reports-are-exempt from release under section 552th} 15) Onited States Code, 
“E add n ens 2 “Dob Freed Finfo i 





e The COBRA data call gathered data to develop costs, savings, and 
payback (formerly known as return on investment) of proposed 
realignment and closure action. 


¢ The Joint Process Action Team Criterion Number 7 data call gathered 
data to assess the community’s ability to support additional forces, 
missions, and personnel associated with individual scenarios.’ 


e The scenario specific data call questions gathered data related to 
specific scenario conditions for realignment or closure. 


BRAC Intelligence Agencies’ Data Calls. The Intelligence agencies’ collection 
process was divided into the following data calls — capacity analysis, Military 
value, and scenario specific. The scenario specific data call included COBRA 
data. The Joint Process Action Team collected the data for Criterion Number 7, 
which the Intelligence JCSG used to develop its scenario specific data calls. The 
National Geospatial-Intelligence Agency was the only intelligence agency 
required to collect its own data for Criterion Number 7. The Intelligence agencies 
used a manual process to collect data call responses. 


DoD Office of Inspector General Responsibility. The Under Secretary of 
Defense for Acquisition, Technology, and Logistics’ memorandum, 
“Transformation Through Base Realignment and Closure (BRAC 2005) Policy 
Memorandum One-Policy, Responsibilities, and Procedures,” April 16, 2003, 
required the DoD Office of Inspector General (DoD OIG) to provide advice and 
review the accuracy of BRAC data and the certification process. This report 
summarizes issues related to the National Security Agency (NSA) BRAC 2005 
process. 


Internal Control Plans, Before the BRAC data calls were released to the 
Service and Defense agencies, OSD required the Services and the Defense 
agencies to prepare internal control plans ([CPs) that incorporated and 
supplemented the OSD ICP. The OSD ICP was issued in the “Transformation 
Through Base Realignment and Closure (BRAC 2005) Policy Memorandum 
One--Policy, Responsibilities, and Procedures.” The NSA prepared “National 
Security Agency 2005 Base Realignment and Closure (BRAC) Internal Control 
Plan (ICP)” on February 4, 2004, to comply with the OSD requirement. 


NSA. The NSA, located in Fort Meade, Maryland, is America’s cryptologic 
organization, it coordinates, directs, and performs highly specialized activities to 
protect the United States information systems and produce foreign intelligence 


"A scenario is a description of one or more potential closure or realignment actions identified for formal 
analysis by either a JCSG or a Military Department. 











information. The NSA was required to submit data for the capacity analysis, 
Military value, and scenario specific data calls. 


Objectives 


The overall objective of the audit was to evaluate the validity, integrity, and 
supporting documentation of data that the NSA collected and submitted for the 
BRAC 2005 process. In addition, we evaluated whether the NSA complied with 
the OSD and NSA ICPs. This report is one in a series on data integrity and 
internal control processes for BRAC 2005. See Appendix A for a discussion of 
the scope and methodology and prior coverage related to the audit objectives. 














National Security Agency Base 
Realignment and Closure 2005 Data Call 
Submissions and Internal 

Control Processes 


The responses provided by NSA for the BRAC 2005 data calls were 
generally not fully supported. The NSA collected and submitted 
responses to 17 questions during the capacity analysis data call, 7 of 
which were partially supported and 2 unsupported. The NSA collected 
and submitted responses to 11 questions during the Military value data 
call, 8 of which were partially supported. This occurred because the NSA 
provided inconsistent and inadequate supporting documentation. 


The data collection processes for the capacity analysis, Military value, and 
scenario specific data calls generally did not comply with applicable ICPs 


as follows. 


Policies, procedures and management of the data collection 
were not followed. 


Individuals with substantial involvement in the preparation and 
submissions of information did not provided certification 
statements. 

Nondisclosure agreements were not signed and maintained. 


BRAC documents were not marked properly. 


Data collection requirements were not followed. 


The lack of adequate supporting documentation for the capacity analysis, 
Military value, scenario specific data calls, and identified noncompliances 
with the ICPs could impact the reliability and integrity of data that NSA 
provided for the BRAC 2005 analysis. 


NSA BRAC 2005 Data Call Submissions 


The BRAC 2005 data call responses provided by the NSA for the capacity 
analysis, Military value, and scenario specific data calls were generally not fully 
supported. The NSA headquarters forwarded all data call questions and collected 
the supporting documentation for each of its sites. We evaluated the validity and 














integrity of the supporting documentation at the NSA headquarters. Specifically, 
for the capacity analysis, Military value, and scenario specific data calls, we 
compared responses to supporting documentation. As we identified problems 
with data submissions, we worked with management to correct the data. 


Capacity Analysis Data Call. The NSA collected and responded to 17 questions 
for the capacity analysis data call, 7 of which were partially supported and 

2 unsupported. The NSA identified 16 of 17 questions that applied to its office. 
We concluded that questions 1, 2, 4, 6, 9, 10, and 11 were supported, questions 7, 
8, 12, 13, 14, 15, and 17 partially supported, and questions 3 and 5 were 
unsupported (see Appendix B for details on those questions). In addition, we 
reviewed the one question that NSA determined was “Not Applicable” and agreed 
with the NSA conclusion. Based on our review and discussions with NSA 
management, we recommended that NSA provided additional supporting 
documentation and methodology to correct the issues. However, NSA 
management stated that no additional supporting documentation would be 
provided. 


Military Value Data Call. The NSA collected and responded to 11 questions for 
the Military value data calls, 8 of which were partially supported. The Military 
value data call consisted of 11 questions with multiple parts; if one segment of the 
question was not supported, the overall question would be partially supported. 
We relied on the agency responses when they answered “no,” “zero,” and 
“unknown” to applicable questions because all BRAC data were certified as 
accurate and complete to the best of the certifiers knowledge and belief. We 
concluded that questions 23, 25, and 28 were supported and questions 18 through 
22, 24, 26, and 27 were partially supported (see Appendix B for details on those 
questions). Based on our review and discussions with NSA management, we 
recommended that NSA provided additional supporting documentation and 
methodology to correct the issues. However, NSA management stated that no 
additional supporting documentation would be provided. 


Scenario Specific Data Call. The NSA scenario data call provided inadequate 
supporting documentation to validate the responses. We reviewed one scenario 
specific data call at NSA; each scenario contained 9 screens (Tables of data). We 
evaluated the responses and supporting documentation at NSA and identified 2 of 
the 9 screens that lacked reasonable supporting documentation and methodology 
that would allow us to reconstruct the cost and contractor responses. Based on 
our review and discussions with NSA management, we recommended that NSA 
provided additional supporting documentation and methodology to correct the 
issues. However, NSA management stated that no additional supporting 
documentation would be provided. 








3 He Ei ATE aa ease tinder ee fb h Enited Sta ‘Code; 





Internal Control Processes 


The NSA generally did not comply with the NSA ICP during the capacity 
analysis, Military value, and scenario specific data calls. We evaluated whether 
the NSA ICP properly incorporated and supplemented the OSD ICP and 
determined that it properly incorporated and supplemented the OSD ICP. We 
evaluated the NSA compliance with the NSA ICP for all BRAC data calls. 
Specifically, we evaluated whether sites completed nondisclosure agreements and 
properly collected, marked, safeguarded, certified and maintained BRAC data. 


Completeness of ICP. The NSA BRAC 2005 ICP provides a uniform set of 
controls designed to provide accountability information and analysis used in the 
BRAC 2005 process. The NSA ICP establishes organizational responsibilities 
that ensure the accuracy and completeness of data collection, analyses, and 
control mechanisms to safeguard the BRAC information. Specifically, the NSA 
ICP provides guidance on the responsibilities of NSA organizations, and direction 
on documentation requirements to address responses. 


Compliance with ICPs. The NSA data collection and certification processes for 
the capacity analysis, Military value, and scenario specific data calls generally did 
not comply with the NSA and OSD ICPs policies, procedures, and management 
of data collection. The NSA ICP identified key roles and responsibilities to be 
carried out by the Alternate BRAC Representative, which included exercising 
oversight and authority for implementation and adherence to the NSA ICP. The 
NSA did not designate the Alternate BRAC Representative; as a result, the NSA 
ICP was not effectively implemented and executed during the capacity analysis, 
Military value, and scenario specific data calls. Also, individuals with substantial 
involvement in the preparation and submissions of information did not provide 
certification statements. 


During the capacity analysis and scenario specific data calls some nondisclosure 
agreements were not signed and maintained with the master file. BRAC 
documents used to support answers were not properly marked in the header or 
footer with the “Deliberative Document — For Discussion Purposes Only — Do 
Not Release Under FOIA.” In addition, requirements listed in the NSA ICP, 
“NSA Data Collection Plan,” which included listing the sources of data, methods 
of collection, and titles of individuals who collected the data were not included 
with the responses. 


Conclusion 


The responses provided by NSA for the BRAC 2005 data calls were generally not 
fully supported. The NSA collected and submitted responses to 17 questions 











during the capacity analysis data call, 7 of which were partially supported and 

2 unsupported. The NSA collected and submitted responses to 11 questions 
during the Military value data call, 8 of which were partially supported. The data 
collection processes for the capacity analysis, Military value, and scenario 
specific data calls generally did not comply with applicable ICPs. During the 
capacity analysis, Military value, and scenario specific data calls we identified 
noncompliances with the OSD and NSA ICPs. 


We discussed our findings with NSA management after each data call. NSA 
management concurred with the findings, but stated that no additional supporting 
documentation would be provided. 


We believe that the lack of adequate supporting documentation for the data calls 
and identified noncompliances with ICPs could impact the reliability and integrity 
of data that NSA provided for the BRAC 2005 analysis. 


Management Comments and Audit Response 


NSA Comments. The Director, NSA generally agreed with the overall report. 
However, regarding the problems identified, NSA stated that this was the first 
time that intelligence functions were included in BRAC and there was a steep 
learning curve. Specifically, NSA agreed that BRAC documents were not 
properly marked and that some question were not fully supported. However, the 
NSA disagreed with the tone of the report, and felt that that no additional 
supporting documentation could have been provided, In addition, NSA stated 
that all nondisclosure agreements and certifications statements were signed by all 
individuals involved in the BRAC process. 


Audit Response. We agree with the NSA that the BRAC 2005 process was new 
to the Intelligence Community. However, the OSD and the NSA internal control 
procedures were not being followed which resulted in policies, procedures and 
management of the data collection not being effectively implemented and 
executed. 


The DoD OIG played a pro-active role with the NSA prior to validating the data 
calls. We visited the NSA prior to our validation of data to discuss, and give 
examples of adequate supporting documentation for each question. During our 
validation of the data calls, we recognized that some data was not available; 
however, we identified instances were additional supporting documentation, 
detailed methodologies or amendments to data could have fully supported some 
NSA responses. During numerous visits and discussions with management little 
or no additional documentation was provided. 








If as stated by NSA, that all nondisclosure agreements and certification statements 
have been signed; we are pleased with the corrective action taken. However, 
during our validation, we identified and NSA stated that several individuals who 
had knowledge of the BRAC process did not sign nondisclosure agreements. In 
addition, individuals with substantial involvement in the preparation and 
submissions of information did not provide certification statements at their level 
as required in the NSA ICP. The lack of adequate oversight, noncompliance with 
the internal control plan written by NSA, and the lack of adequate supporting 
documentation are the basis for questioning the reliability and integrity of the 
data. 








Appendix A. Scope and Methodology 


We evaluated the validity and integrity of all data call responses and the 
associated supporting documentation of NSA BRAC 2005 data. Specifically, we 
performed the following audit steps during the capacity analysis, Military value, 
and scenario specific data calls. 


Interviewed the personnel responsible for preparing and certifying the 
responses to the data calls, 


Reviewed all data call responses and associated supporting 
documentation. 


Compared the adequacy of responses to the supporting documentation. 


Reviewed “Not Applicable” question responses to determine whether 
they were reasonable. 


Reviewed the NSA ICP to determine whether the NSA incorporated 
and supplemented the OSD ICP and established and implemented 
procedures and processes to disseminate, collect, safeguard, and 
maintain supporting documentation. In addition, we reviewed whether 
the NSA designated the appropriate personne! to certify that data and 
information collected were accurate and complete to the best of the 
certifier’s knowledge and belief. 

Relied on Military value responses when they answered “no,” “zero,” 
or “unknown” to applicable questions because all BRAC data were 
certified by the Director, NSA as accurate and complete. 


Reviewed NSA’s responses to the combined scenario HSA-0099. 


Worked with management to correct identified problems to data call 
responses. 


We could not validate that the NSA was consistent in reporting all sites during the 
capacity analysis data call. Also, because of time constraints, we validated only 
the NSA COBRA and scenario data calls for potential candidate 
recommendations that were approved by the Infrastructure Steering Group. 


Capacity Analysis Data Call. The NSA headquarters received the capacity 
analysis data call questions | through 17 from the Intelligence JCSG. NSA 
headquarters then forwarded all questions to each of its sites and collected 
supporting documentation and responses at NSA headquarters. All supporting 











documentation was maintained at headquarters for validation. We reviewed all 
data call questions and responses at NSA headquarters for accuracy, appropriate 
markings, and adequacy. We issued one capacity analysis site memorandum to 
summarize the site visit results. Specifically, we reviewed the following 
responses and supporting documentation. 


Capacity Analysis Data Call Questions Reviewed 





Question Number 





NSA Site Answered Not Applicable 














NSA headquarters 1-15 and 17 16 





Military Value Data Call. The NSA headquarters received Military value data 
call questions 18 through 28 from the Intelligence JCSGs. Most Military value 
questions had multiple parts. The NSA then forwarded all questions to each of its 
sites and collected supporting documentation and responses at NSA headquarters. 
All supporting documentation was maintained at headquarters for validation. We 
reviewed the data call questions and responses at NSA headquarters for accuracy, 
appropriate markings, and adequacy for each site. We issued one Military value 
site memorandum to summarize the site visit results. 


Scenario Specific Data Call. NSA headquarters received scenario and COBRA 
data call questions from the Intelligence JCSGs. Specifically, we reviewed one 
scenario specific data call for NSA. We reviewed the data call responses at NSA 
headquarters for reasonableness and supporting documentation. Specifically, we 
reviewed NSA responses to the combined scenario HSA-0099. 


We performed this audit from February 2004, through April 2005, in accordance 
with generally accepted government auditing standards. 


Reliability of Computer-Processed Data. We did not test the accuracy of the 
computer-processed data used to support an answer to a data call question. 
Potential inaccuracies in the data could affect the results. However, all BRAC 
data were certified as accurate and complete to the best of the certifier’s 
knowledge and belief. 


Government Accountability Office High-Risk Areas. The Government 
Accountability Office has identified several high-risk areas in DoD. This report 
provides coverage of the DoD Support Infrastructure Management and Federal 
Real Property high-risk areas. 














Management Control Program Review 


We did not review the NSA management control program because its provisions 
did not apply to the one-time data collection process; however, we evaluated the 
NSA internal controls for preparing, submitting, documenting, and safeguarding 
information associated with the BRAC 2005 data calls, as directed by the OSD 
and NSA ICPs, to determine whether the NSA complied with the ICPs. 
Specifically, we evaluated the procedures that NSA used to develop, submit, and 
document its data call responses. Internal controls were generally inadequate as 
they applied to the audit objective (see the Finding section for additional details). 


Prior Coverage 


During the last 5 years, the DoD OIG issued 2 site memorandums discussing the 
NSA BRAC 2005 data call submissions and internal control processes. 


Site Memorandums 
DoD IG Memorandum, “Audit on the Military Value Data Call Submission from 


all National Security Agency Sites to the National Security Agency Headquarters 
for Base Realignment and Closure 2005,” March 3, 2005 


DoD IG Memorandum, “Audit on the Capacity Analysis Data Call Submission 
from National Security Agency Headquarters for Base Realignment and 
Closure 2005,” September 21, 2004 

















Appendix B. BRAC 2005 Data Call Questions Not 


Fully Supported 


Capacity Analysis Data Call. For the capacity analysis data call, NSA provided 
data that were generally not fully supported. We identified responses during the 
capacity analysis data call that did not provide adequate supporting 
documentation or completely answer the BRAC question. 


The response to question number 3 was unsupported. The questions 
required the NSA to provide personnel by subfunction and attribute. 
The NSA did not provide adequate methodologies to track 
documentation to the responses. The NSA did not provide 
documentation to validate contracting personnel. In addition, the 
responses NSA provided did not agree with the documentation 
provided. 


The response to question number 5 was unsupported. The question 
required the NSA to provide authorized personnel at the Pentagon by 
subfunction and attribute. The NSA provided a summary sheet, 
without supporting documentation to support the answers provided. In 
addition, the responses NSA provided did not agree with the 
documentation provided. 


The response to question 7 was partially supported. The question 
required work years for management activities by building. The NSA 
provided the responses in total by location. 


The response to question 8 was partially supported. The question 
required accounting and finance transactions by building. The NSA 
provided the responses in total by location. 


The response to question 12 was partially supported. The question 

required the number of personnel serviced by Headquarters Human 
Resources by building. The NSA provided the responses in total by 
location. 


The response to question 13 was partially supported. The question 
required the NSA to provided new hire processing information. The 
NSA did not provide complete supporting documentation to support 
responses to applicants hired and resumes received. 











e The response to question 14 was partially supported. The question 
required the NSA to provided training and education information. The 
NSA did not provide supporting documentation for several locations. 


© The response to question 15 was partially supported. The question 
required the NSA to provide student training counts and completions. 
The NSA did not provide supporting documentation to support 
e-learning population. 


e The response to question 17 was partially supported. The question 
required the NSA to list projected student population totals for 
FY 2004 through FY 2009 by building. The NSA did not respond to 
the BRAC question by location. 


Military Value Data Call. For the Military value data call, NSA provided data 
that were generally not fully supported. We identified responses during the 
Military Value data call that did not provide adequate supporting documentation 
or completely answer the BRAC question. 


e The response to question18 was partially supported. The question 
required the NSA to document the facility capabilities. The NSA did 
not provide adequate supporting documentation to support parking 
space counts. The NSA did not provide complete documentation to 
support generator power usage. 


e The response to question 19 was partially supported. The question 
required the NSA to list the facility condition. The NSA did not 
provide documentation to support several NSA buildings. 


© The response to question 20 was partially supported. The question 
required the NSA to provide responses to survivability and force 
protection responses. Several NSA locations did not provide 
supporting documentation to support responses. In addition, the NSA 
did not provide adequate methodologies to track documentation to the 
responses. 


e The response to question 21 was partially supported. The question 
required the NSA to identify the type of specialized equipment at each 
building. The NSA provided supporting documentation based on 
physical observation only and not verifiable data. Also, the NSA did 
not provide supporting documentation for several locations. 


e The response to question 22 was partially supported. The question 


required the NSA to report sensitive compartmented intelligence 
facility space. The NSA did not provide adequate and reasonable 
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documentation to support responses. The NSA provided accreditation 
letters generated during our review. 


e The response to question 24 was partially supported. The question 
required the NSA to identify the type of continuity of operations 
planning at each building. No supporting documentation was provided 
to support NSA site responses. 


e The response to question 26 was partially supported. The question 
required the NSA to the provide personnel intellectual expertise. The 
NSA did not provide documentation to support Military and contractor 
data. 


e The response to question 27 was partially supported. The question 
required the geographic and professional relationship to NSA. The 
NSA provided inconsistent and duplicate responses for colleges, 
universities and commercial firms located near the NSA sites. 
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NATIONAL SECURITY AGENCY 
FORT GEORGE G. MEADE, MARYLAND 20785-4000 





12 May 2005 


MEMORANDUM FOR DEPUTY ASSISTANT INSPECTOR GENERAL FOR 
INTELLIGENCE EVALUATIONS 


SUBJECT: (U) CLOSE HOLD DoD IG Report on NSA Data Call Submissions and 
Internal Control Processes for BRAC 2005 — Comments to IG 


(U) Four problem areas in the BRAC 2005 Capacity Analysis Data Call are 
identified by the subject draft IG report; improper document markings, unsigned/ 
un-maintained Non-Disclosure Agreements (NDAs), missing responder 
certifications, and unsupported data, We agree with the auditors that some 
hardcopy pages are incorrectly marked or are not marked. Great effort was 
expended to ensure 100% compliance in this area and the volume of paper plus the 
last minute flurry of replacement pages contributed to the less than 100% 
conformance. None of the data pages were unmarked, but a few certification sheets 
or NDAs can be found without the proper or complete BRAC disclaimer. The initial 
NDA and Certification Forms we recaived from DoD were not properly marked and 
proliferated in the system. We did not track down everyone who had signed an 
early version to have them re-sign a newer form. Nor did we achieve 100% success 
by stamping the original forms, 


(U) We have signed certifications from responders for each of the 16 Capacity 
Analysis Data Call questions NSA answered. Individuals who participated in 
vetting the Data Call information signed the certifications forms. Perhaps these 
certification statements were provided subsequent to the auditor's last review day 
and that is why the report states there are missing certifications for some questions. 





(U) We did as thorough a job as possible to secure all the NDAs that NSA 
employees/service members signed, When the DoD originally initiated the BRAC 
2005 Intelligence Capacity Analysis Data Call, NDAs for NSA employees were 
signed and retained by the DoD-designated Group Leads for Sources & Methods, 
C2A2, and Headquarters Management. To our knowledge those NDAs are still in 
their possession. NSA has NDAs for all the NSA/CSS individuals whom we believe 
participated in the Capacity Analysis Data Call. Persons whom we queried about 
data or the existence of data, but were not informed why or for what purpose the 
data was needed were not asked to sign NDAs. We are unaware of any individuals 
who actively participated in this phase of BRAC who did not sign at least one NDA. 
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(U) The final problem area is the most problematic to address — Data 
Supportability. Of the 17 Capacity Analysis Data Call questions, NSA found that 
16 were applicable. Of those 16 the auditors found 7 fully supported, 7 partially 
supported, and 2 unsupported. In addition, the auditors found that the hardcopy 
data did not always agree with the data entered by Oracle into the DoD Intell 
database. 


(U) A bit of background is necessary to understand the difficulty both NSA 
and the auditors encountered trying to determine data supportability. In the Fall of 
2003 DoD requested that Defense Intelligence agencies participate in working 
groups to create questions and attributes for the Intelligence portion of BRAC 2005. 
This was the first time that Intelligence functions were included in BRAC and there 
was a steep learning curve. In addition, the rest of the DoD had been working on 
their BRAC data call for some 9 months before it was determined that Intelligence 
would participate, so there was much to do in a compressed time frame. The 
Intelligence Working Groups (Sources & Methods, C2A2, and Headquarters 
Management) labored for two months crafting questions and attributes for the 
Capacity Data Call. At the end of CY2003 DoD determined that the data call would 
use traditional BRAC questions resulting in the 17 Capacity Analysis Data Call 
Questions. That was fine except that it was also determined that the attributes 
identified by the groups (that only were relevant to their original questions) would 
also be used. The logic fell apart quickly and it was truly an apples and oranges 
exercise in many cases. Here is one example. Capacity Analysis Data Call 
Question #3, which was audited as “unsupported”, required NSA to provide 
personnel position data by subfunction (e.g, Sources & Methods) and personnel 
position data by attribute (e.g. Levying Intel Collection Requirements — 
Requirements Validation and Prioritization Long term, Levying Intel Collection 
Requirements — Requirements Validation and Prioritization Short Term). This 
meant that NSA needed to be able to look at its table of distribution and identify 
how many positions levy Intelligence collection requirements short term and how 
many positions levy Intelligence collection requirements long term. The apples and 
oranges flavor should have become clear by now. In this example, NSA doesn’t 
differentiate ita positions based upon whether the position is dealing with a long or 
short term collection requirement. The data call was fraught with these problems. 
In order to provide the information NSA rollod the attributes up to the Sub- 
Function level and attempted to report the position data that way. It was not a 
perfect solution as the auditors have noted. That said the auditors have agreed that 
87.5% of all questions were supported completely or partially by data. In those 
cases where we could not put a round peg into a square aperture, we described the 
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methodologies and deductions used to obtain the result. NSA is confident that all 
data is accounted for and could be used to support the overarching objectives of this 
Capacity Data Call. 


(U) The auditors are correct that discrepancies exist between the data call 
documented in hardcopy and the Oracle Database. The reason for this is the Oracle 
Contractors were using software with which they were unfamiliar. The software 
was not adequately documented and the contractors learned how it worked by trial 
and error. As they attempted to load our data they would encounter problems with 
format, naming conventions or special character limitations. The contractors then 
advised NSA when and how we had to change the data to make it load into the 
database. The changes in the main did not change the data. In each case NSA 
provided an errata sheet with each new Compact Dise indicating how the softcopy 
data differed from the hardcopy. Perhaps the auditors were not able to review that 
information. 





(U) Several times throughout the draft IG report the following wording is 
used: “Based on our (the auditors) review and discussions with NSA management, 
we recommended that NSA provide additional supporting documentation and 
methodology to correct the issues. However, NSA management stated that no 
additional supporting documentation would be provided.” While these words are 
true, they do not explain the basis for NSA not providing additional information. 
NSA did not provide additional supporting data because we had no way to do so, As 
stated above in order to answer several of the questions NSA had to aggregate data 
instead of using the attributes that had become artificial constructs. While NSA 
documented the assumptions and methods used to perform the calculations, clearly 
the auditors are correct that there was not explicit supporting data. The data 
resulted from arithmetic calculations and distribution assumptions. The report 
conveys the impression that NSA could have provided additional supporting 
documentation but just chose not to. That is far from the case. 

NSA worked diligently to provide supporting data, but as explained above the data 
was unknowable. 


(U) Problem areas in the BRAC 2005 NSA Military Value Data Call 
submission are identified in the subject draft IG report. The report identifies 
several questions that were not fully supported. Although the auditors and the NSA 
Mil Value Team reviewed and discussed the auditors’ findings at the end of the 
audit, the report does not clearly explain the inability of NSA to provide additional 
supporting documentation to partially supported responses. The auditors reviewed 
the 11 questions to which NSA responded, These 11 Military Value questions broke 
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down into 51 individua) data responses. Three questions were fully supported, 
leaving 8 questions partially supported. 


(U) As was the case in the Capacity Analysis data call, what the report docs 
not do is explain the basis for NSA not providing additional information for 
supporting documentation. NSA did not provide additional supporting data because 
it was non-existent. Several questions in the Military Value Data Call required 
supporting documentation that is not tracked or recorded in the format required to 
answer the questions. While NSA provided as much supporting documentation as it 
could for each question as well as the methodologies for all of the data, it was 
impossible to provide supporting documentation that was acceptable to the 
auditors. For example, the report states NSA did not provide supporting 
documentation for parking space counts (question 18). But the auditors could not 
accept a specific, physical count of the spaces as supporting documentation, making 
the response only partially supported. Question 19 was partially supported because 
not all buildings had been surveyed to provide the facilities conditions. 


(U) The NSA BRAC team members spent many long hours and went to great 
lengths obtaining al) existing data necessary to answer the data call. NSA agrees 
with the auditors that each question was not answered and supported 100%, 
However, the report conveys the impression that NSA could have provided 
additional supporting documentation but just chose not to. That is far from the 
case. NSA worked diligently to provide supporting data, but as explained above, 
the data was non-existent. 


(U) We appreciate the time the auditors spent working with us at NSA and 
the patience and information they provided to us in an attempt to meet a 100% 
supportable submission. Thank you for the opportunity to comment on this draft 
report. 






LIAM B. BLACK, 
Acting Director 
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